Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.
Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?
Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.
It will block an "rm" call if your prompt did not include anything about "deleting something".
It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.
Anthropic's documentation does distinguish permission rules and pre-tool hooks from model instructions. It also documents OS-enforced sandboxing for shell commands, which has a narrower scope than all agent actions.
An independent stress-test of Auto mode is available here: https://arxiv.org/abs/2604.04978. It's a behavioral evaluation, not a source-code audit.
The important question is whether every state-changing action passes through an enforceable boundary before execution, including indirect actions through file edits or scripts. Post-execution validation is a separate control.
Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.
Code is a reflection. Of what? Look there. Code itself is useless.
I am not sure what is hard about this distinction to grasp, why would it matter if CC shared my email if I share my email on my own websites?
The solution is, like you are already alluding to, to not give it access. But that requires a level of isolation that folks normally don't do. To the contrary, the AI agent ads to non-tech folks emphasize it acting like a personal assistant which by its nature needs access to data you don't normally want public. Emails, photos, files with written notes, etc.
This is strictly needed for throttling reasons, your email address will only be temporarily stored in the volatile memory of the device.
(If you think there is anything wrong with this then you do get the point and silence speaks louder than words)
(sorry, i think you make a good point, ... but i could not resist.)
Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.
I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.
Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?
I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)
Sure you can have an issue tracker with 1000 items and yes, you can have a bot solve them all in a day, but who monitors it? Who gets to say what he did at the standup? Who reports to whom and what?
Code is not the bottleneck (if it ever was..)
Will Northrop Grumman, the state government of Alaska, the construction industry, etc. somehow magically move faster than Anthropic?
Not saying the current crop of AI companies is going to make it but the tech itself isn’t going away.
But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.